SetNamedSecurityInfo running under SYSTEM account

From: System (S_1_5_18_at_hotmail.com)
Date: 01/12/04

  • Next message: Jan Plastenjak: "Activation Codes" 
    Date: Mon, 12 Jan 2004 12:17:00 +0100

    Hi!

    I am using SetNamedSecurityInfo to set both the dacl and sacl of a
    directory. I have tested my code under the admin account and it works but
    when I run it from our (msi) setup under the local system account there is
    something odd. When setting the SACL, SetNamedSecurityInfo returns error
    1314 (ERROR_PRIVILEGE_NOT_HELD) ..

    I thought that the privs was enabled by default for Local System but it
    dioes not seem the case ( I have tested it).

    Anyway, In my code I explicitely enable the SE_SECURITY_NAME privilege.

    for the record, I have also enabled SE_TAKE_OWNERSHIP_NAME for the dacl.

    has anybody ever managed to use SetNamedSecurityInfo from the LocalSystem
    account?

     // audit everyone
     ACL* sacl =0;
     DWORD lenSacl;

     lenSacl = sizeof(ACL) + sizeof(ACCESS_ALLOWED_ACE)
                + GetLengthSid(worldSid) - sizeof(DWORD);

     sacl = (ACL *) malloc( lenSacl );
     InitializeAcl(sacl, lenSacl, ACL_REVISION);

     ACCESS_MASK m = GENERIC_WRITE | WRITE_OWNER | WRITE_DAC | DELETE;
     AddAuditAccessAce(sacl, ACL_REVISION, m, worldSid, TRUE, TRUE);

     secinfo = SACL_SECURITY_INFORMATION | PROTECTED_SACL_SECURITY_INFORMATION ;
     EnableTokenPrivilege(msi, SE_SECURITY_NAME);

     rc = SetNamedSecurityInfo( mydir, SE_FILE_OBJECT, secinfo, 0, 0, 0, sacl );

    rc is ERROR_PRIVILEGE_NOT_HELD !!

    Thanks.

  • Next message: Jan Plastenjak: "Activation Codes"

    Relevant Pages

    • Re: Access Rights to See DACLs in ADAM
      ... DACLs do not control access to a SACL. ... you should edit local security policy using ... When I turned off the SACL option in LDP, I AM able to access the DACL ... account is not a local administrator account. ...
      (microsoft.public.windows.server.active_directory)
    • Re: SetNamedSecurityInfo running under SYSTEM account
      ... > when I run it from our setup under the local system account there is ... When setting the SACL, SetNamedSecurityInfo returns error ...
      (microsoft.public.platformsdk.security)
    • Re: SetNamedSecurityInfo running under SYSTEM account
      ... but does EnableTokenPrivilege succeed or fail? ... I have tested my code under the admin account and it works ... When setting the SACL, SetNamedSecurityInfo returns error ...
      (microsoft.public.platformsdk.security)
    • RE: Security-API NT/XP
      ... Wenn der Account zur Gruppe der Benutzer gehört kann diese Person nur die Prozesse beenden die unter seinem Account laufen. ... > manipuliert seine eigene SACL indem ein AcessDenied ACE in die SACL ...
      (microsoft.public.de.vc)
    • Quantcast